İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


To: Bizfella Limited 


Of: Metropolitan House, Station Road, Cheadle Hulme, Cheadle, Cheshire, 
England, SK8 7AZ 


1. The Information Commissioner (“the Commissioner”) has decided to 
issue Bizfella Limited (“Bizfella”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is in relation 
to a serious contravention of Regulation 22 of the Privacy and Electronic 
Communications (EC Directive) Regulations 2003 (“PECR”). 


2. This notice explains the Commissioner’s decision. 


Legal framework 


3; Bizfella, whose registered office is given above (Companies House 
Registration Number: 09219302) is the organisation stated in this notice 
to have instigated the transmission of unsolicited communications by 
means of electronic mail to individual subscribers for the purposes of 


direct marketing contrary to regulation 22 of PECR. 


4. Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing (free 
of charge except for the costs of the transmission of the 
refusal) the use of his contact details for the purposes of such 
direct marketing, at the time that the details were initially 
collected, and, where he did not initially refuse the use of the 


details, at the time of each subsequent communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of advertising 
or marketing material which is directed to particular individuals”. This 


definition also applies for the purposes of PECR (see regulation 2(2) PECR 
and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


Consent in PECR is defined, from 29 March 2019, by reference to the 
concept of consent in Regulation 2016/679 (“the GDPR”): regulation 8(2) 
of the Data Protection, Privacy and Electronic Communications 
(Amendments etc) (EU Exit) Regulations 2019. Article 4(11) of the GDPR 
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sets out the following definition: “‘consent’ of the data subject means 
any freely given, specific, informed and unambiguous indication of the 
data subject's wishes by which he or she, by a statement or by a clear 
affirmative action, signifies agreement to the processing of personal data 


relating to him or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that "Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 


processing operations despite it being appropriate in the individual case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic communications 


services for the supply of such services”. 


10. 


11. 


12. 


13. 


iCO. 


Information Commissioner’s Office 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, voice, 
sound or image message sent over a public electronic communications 
network which can be stored in the network or in the recipient’s terminal 
equipment until it is collected by the recipient and includes messages 


sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in Regulation 
22(3) of PECR. In essence, an organisation may be able to e-mail its 
existing customers even if they haven't specifically consented to 
electronic mail. The soft opt-in rule can only be relied upon by the 


organisation that collected the contact details. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to PECR, 


as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC Directive) 


Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable’ steps to prevent’ the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 


of the DPA about the issuing of monetary penalties that has been 
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published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ overall 


aim of ensuring high levels of protection for individuals’ privacy rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Bizfella is an FCA registered credit broker that trades under various 
names including Cash Carrot and Pixie Loans. As part of its business, 
Bizfella operated a number of websites including a Cash Carrot website 


and a Pixie Loans website. 


Individuals can submit loan applications on the websites operated by 
Bizfella (including the Cash Carrot and Pixie Loans websites). These 
applications are then passed to Bizfella’s panel of lenders to be approved 


or declined. 


Bizfella came to the Commissioner’s attention from monitoring 
complaints received via the 7726 spam text reporting service. 904 
complaints had been submitted through the 7726 service and two further 
complaints were received by the Commissioner directly. These 
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complaints related to two differently worded SMS messages that referred 


to Cash Carrot. The text of the SMS messages was as follows: 


i. “CASH CARROT UPDATE Still want a loan {firstname}? 
You're OK to apply for £400+ Any credit status alright. 
See www.Cash-Carrot.net/a 669%RAPR opt-out.cc 
1/3. 


2/3 Warning: Late repayments can cause you serious 
money problems. For help, got to 


© AE Ltd is an independent 


credit broker, not a lender. 


3/3 Representative example/e £400 borrowed for 90 
days. Total amount repayable is £561.92 in 3 monthly 
instalments of £187.31. Interest charged is £161.92, 
interest rate 161.9% (variable). Representative 669% 
APR”; and 


ii. “{firstname} it's i - at Cash Carrot. You're OK to 
apply for MONEY TODAY. No fees, ANY credit alright. Visit 
www.Cash-Carrot.net/f 669%RAPR opt-out.cc 1/3 


2/3 Warning: Late repayments can cause you serious 


money problems. For help, got to 


-E-n Ltd is an independent 


credit broker, not a lender. 


3/3 Representative example/e £400 borrowed for 90 
days. Total amount repayable is £561.92 in 3 monthly 
instalments of £187.31. Interest charged is £161.92, 
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interest rate 161.9% (variable). Representative 669% 
APR.” 


Those SMS messages included the URL www.Cash-Carrot.net which led 
to a landing page that referred to a Oo QE then re- 
directed to www.cashcarrot.co.uk. The website at www.cashcarrot.co.uk 


stated that cashcarrot.co.uk was a trading style of Bizfella. 


Following initial contact by the Commissioner, Bizfella confirmed that it 
owned the website www.cashcarrot.co.uk and clarified hat 
ai “provides the SMS platform we use for sending out text 


messages”. 


On 15 July 2020, the Commissioner sent to Bizfella an investigation letter 
along with a copy of the complaints received through the spam text 
reporting service or received by the ICO directly. The investigation letter 
explained that the Commissioner had concerns about Bizfella’s 
compliance with PECR and requested that, within 21 days,  Bizfella 


provide various information. 


On 29 July 2020, Bizfella replied to the Commissioner. The further 


information provided included: 


a. Bizfella took over the domain www.cashcarrot.co.uk on 14 
August 2019. 


b. In the period 15 July 2019 to 15 July 2020, 1,250,600 SMS 


messages were sent to 133,957 records. 


c. Because the SMS messages were sent via a third-party SMS 


platform (owned MoO Bizfella do not have 


access to the delivery reports. However, the SMS platform had 
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informed Bizfella that, on average, 60% of the messages are 


delivered, such that 750,360 SMS messages would have been 


delivered. 


d. “All the data we use is our own, that has been captured through 
individuals applying on one of our websites for our service, loan 
brokering for HCSTC (high cost short term credit loans or 
payday loans). We contacted our customers via SMS as part of 
the brokering service they requested when applying with us, in 


helping them find a loan.” 


e. “Text messages we send are in relation to the individual’s 
application with us to help them obtain HCSTC Finance...All 
individuals who have been sent a SMS/text message promoting 
cashcarrot.co.uk, which is one of Bizfella’s HCSTC loan 
brokering websites, have ticked 1% party box authorising us, as 
a credit broker, to contact them via SMS, email or phone in 
relation to their application. This is clearly stated in the 
statement before submitting the application and is the 


brokering service they have applied for.” 


f. The “main consent statement” on all of the Bizfella operated 
websites was as follows: 
“By submitting your information, you confirm that you 
provided accurate financial information and considered 
potential future income and outgoings in determining your 
ability to repay. Ticking this box also indicates that you have 
read, understand, and agree to the terms of our Privacy 
Policy and Terms & Conditions of Use, and authorize your 
information to be shared with select lending partners, credit 


brokers and financial savings products, and for them to 
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contact you by SMS, email and automated voice messaging 


in relation to the applications. 


M- E- combine, analyse and profile 


my information and pass their knowledge on to other 
organisations for the purposes of tracing, providing 
important information or returning assets to me. Your data 
may also be used for debt recovery, fraud prevention, to 
support the assessment of credit risk, pricing and affordable 
payments. If you do not want your data to be used in this 


way please click here.” 


g. “Our contact with these individuals is part of the service we 
provide as a credit broker, which we attempt to find them the 
type of loan they have applied for...To provide our customers 
with the best service as a loan broker, we may contact them to 
apply through one of our websites again so we can process their 
application with our panel of lenders, as the result may be 


different on that occasion.” 

h. “138,000 individuals were sent SMS text message over a period 
of 7 months. These generated 14,181 applications on 
cashcarrot.co.uk.” 


i. The 906 complaints are from 419 individuals. 


j. Only 4 of the 419 individuals clicked on the link to opt-out in 
the SMS message. 


23. 


24. 
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k. “This was a trial using SMS to continue helping customers with 


our broker service, we did not know it was making complaints 


and have now ceased this SMS campaign.” 


On 17 August 2020, the Commissioner wrote to Bizfella requesting 


further information. 


On 3 September 2020, Bizfella replied to the Commissioner. The further 


information provided included: 


a. “Our data retention policy is outlined in the Data Use Policy...in 
that policy it says: 
‘Date from the first opt-in may be used for up to two years after 
the application’s submission, to continue helping the applicant 
find a loan - which is what they applied for. Contact will be 
dependent on changes to the lender panel, lending products, 
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accept rates, repayment terms”. 


b. “Lending accept criteria and our lender panel changes 
constantly, and although someone may be declined today, they 
could be accepted next week or next month. If they continue to 
be declined, we may contact them asking if they still want help 
finding a loan.” 

“We re-contact customers to ask if they are looking for finance 
and wish for us to continue acting as their loan broker, by 
applying through us again... 310 out of the 419 individuals [who 
reported the SMS messages as spam] made one or more 
additional applications in the time period July 2019 to July 
2020. 


25. 
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On 18 September 2020, the Commissioner wrote to Bizfella requesting 


further information. 


On 2 October 2020, Bizfella replied to the Commissioner. The further 


information provided included: 


a. “Of the 1,250,600 SMS messages sent, 0O 


now confirmed that 623,752 were delivered”. 


b. “Of the 133,957 records sent an SMS, 1865 had their data 
collected from Cashcarrot.co.uk. The other 132,092 individuals 
had applied via our other credit broker websites and were 
contacted via the ‘soft opt-in’ rule - ‘similar products or 


ou 


services’. 


c. “Information is obtained from an individual making an 
application on one of our websites and agreeing to the opt- 


in/consent box before they submit this information to us.” 


d. “We only send direct marketing that relates to their application, 
where they ask us to act as their credit broker to help them find 


a loan.” 


e. “All data collected via our credit broker websites, which Cash 
Carrot is one, all contain the same opt-in boxes and consent 


wording, privacy policy and service.” 


f. “The wording at the point of opt-in/consent is clear...in that 
lenders and credit brokers will contact them in connection with 
the application they are submitting. If lenders and credit 


brokers cannot contact the individual, we cannot provide the 
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service they are asking for. The individual can choose not to go 


ahead, if they wish not to be contacted.” 


On 20 October 2020, the Commissioner wrote to Bizfella requesting 


further information. 


On 28 October 2020, Bizfella replied to the Commissioner and suggested 
that a meeting be arranged. That meeting took place on 13 November 
2020. 


At the 13 November 2020 meeting, Bizfella stated: 


a. The websites used to collect the data used to SMS messages 
are primarily the Cash Carrot and Pixie Loans websites “but 


there are four or five others that may be used as well”. 


b. SMS messages were not sent to “blanket people” but only to 
those who had applied for the service through the website. If 


Bizfella cannot contact individuals it cannot provide its services. 


c. As well as contacting individuals who have had loan applications 
refused, Bizfella may also contact individuals again when their 


loan matures. 


d. The consent statement relied on by Bizfella is that set out at 


paragraph 22(f) above and constitutes “first party consent”. 


e. Without first agreeing to the first party consent statement, the 


individual could not proceed with the loan application. 


f. The websites operated by Bizfella also contained a third party 
consent statement. The individual could proceed with the loan 
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application without agreeing to the third party consent 


statement. 


g. SMS messages may also be sent under the soft opt-in rule. This 
allowed SMS messages in relation to Cash Carrot to be sent to 
individuals who had applied for loans on other websites 


operated by Bizfella, such as Pixie Loans. 


30. At the 13 November 2020 meeting it was explained to Bizfella that 
nothing in the main consent statement relied on by Bizfella told 
individuals that they would continue to receive marketing updates 
sent by Bizfella. Bizfella responded that individuals who apply for 


loans know the sector and so know that they will be contacted again. 


31. In an email of 16 November 2020, Bizfella stated: 


a. Bizfella did not start sending out SMS messages until 15 
November 2019. 


b. The SMS communications sent to individuals were actually 3 
linked messages, the second of which referred to Bizfella 
Limited such that the recipient would know that Cash Carrot 


was part of Bizfella. 


32. Bizfella also provided the Commissioner with a copy of its updated 


consent statement. 


33. On 17 November 2020, the Commissioner provided advice in relation to 
the updated consent statement including that Bizfella may wish to avoid 


using a combination of opt-in and opt-out boxes. 


Information Commissioner’s Office 


34. On 19 November 2020, the Commissioner wrote to Bizfella requesting 


further information. 
35. On 2 November 2020, Bizfella replied to the Commissioner and stated: 


“Of the 133,957 records sent an SMS, 1865 (929 delivered) had 
their data collected from Cashcarrot.co.uk. The other 132,092 
individuals (65,781 delivered) had applied via our other credit 
broker websites and were contacted via the ‘soft opt-in’ rule i.e. 


we sent them service messages 


The opt-in statement stated ‘you authorise you information to be 


shared with select lending partners, credit brokers, and financial 


saving products, and for them to contact you by SMS, email and 


automated voice messaging in relation to this application’. 


There are two parts of this opt-in statement we used to confirm 


we had the correct consent to contact the customers: 


1. It states ‘credit brokers’ as one of the parties with whom data 
will be shared. We are a credit broker and they would be 
contacted by a credit broker. Pixie Loans and Cash Carrot are 


both credit broker web sites. 


2. It states they would be contacted ‘in relation’ to the application. 
The SMS ‘Service’ messages sent related to that application for 


a loan i.e. are you still wanting a loan. 


Customers need to tick and opt-in to this statement, as without 


opt-in to this statement we can not provide our service to them. 
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36. On 26 November 2020, the Commissioner wrote to Bizfella requesting 


further information. 
37. On 10 December 2020, Bizfella replied to the Commissioner and stated: 


a. “We have third and first party opt-in for 1156 of the 1865 
individuals [who had applied for a loan on the Cash Carrot 
website] (575 delivered messages). 708 individuals (354 


delivered messages) only ticked the first party opt-in.” 


b. “We have third and first party opt-in for 84,458 of the 132,092 
individuals [who had applied for a loan on the Pixie Loans 
website] (42,099 delivered messages). 47,634 individuals 
(23,682 delivered messages) only ticked the first party opt-in.” 


c. “Of the 419 individuals that report SPAM, we have third party 
opt-in for 295 (70%) of these individuals. Our opt-in statement 


for first and third party is clear and is not misleading.” 


d. “I have supplied the information you have requested however, 
the information is NOT relevant to Bizfella contacting its own 
customers, even though a high percentage give third party - 


opt-in.” 


38. On 13 January 2021, the Commissioner wrote to Bizfella requesting 


further information. 


39. On 29 January 2021, Bizfella replied to the Commissioner and stated: 


a. “I do not have access to the deliverable break down by number 


and have assumed based on % overall third party opt-ins. I can 
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only give the number of individuals sent a message, as to 
whether they had third party opt-in - 133,957 records sent a 
message; 66,710 records % assumed delivered. 85,614 of the 


records sent a message we had third party opt-in; 42,674 


records % assumed delivered. 


b. There were two versions of the SMS messages that had been 
sent out. The text of those messages was provided and is set 


out at paragraph 18 above. 
40. On 6 April 2021, the Commissioner wrote to Bizfella as follows: 


“I understand that both of the text message scripts include “You're 
OK to apply for” and then either ‘money today’ or a value of 
money. Are these texts sent out at generic intervals or are there 
any checks done that indicate that the individual will be successful 
in obtaining a loan if they apply when they get the text message? 
If there are any checks done or there is a process for determining 
when individuals should apply for a loan I'd be grateful if you could 


explain what these are.” 
41. On 23 April 2021, Bizfella replied to the Commissioner stating: 


“Please refer to my previous response of 3rd September 2020: As 
a credit broker they have applied for our service, we enquire at 


intervals if they wish for us to help find them finance: 


- We work with lenders on a ‘real-time’ basis, which means the 
customer has to be present whilst their application is being 
submitted. To do this the individual has to visit one of our sites 


and make an application. 
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- Lending accept criteria and our lender panel changes constantly, 
and although someone may be declined today, they could be 
accepted next week or next month. If they continue to be 
declined, we may contact them asking if they still want help finding 


a loan. 


- Individuals apply for loans that start from 1 month up to 5 years 
and we have found that if they are accepted for a loan, they often 


will apply for another when one is satisfied. 


- We re-contact customers to ask if they are looking for finance 
and wish for us to continue acting as their loan broker, by applying 


through us again. 


In addition to the above, we contact individuals if we see lenders 
are being more open to accepting applications and they have the 
minimum matching criteria, based on the information they 


provided in their previous applications. 


No credit checks are performed, as this is against FCA regulation 


as we are a broker not a lender.” 


On 27 April 2021, an end of investigation letter was sent to Bizfella 
confirming that the Commissioner's investigations were complete and 
that consideration would now be given to whether formal enforcement 


action was appropriate. 


In response to a request by the Commissioner for further information, 
on 9 July 2021 Bizfella stated that it no longer operated the Cash Carrot 


website. 
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On 26 July 2021, complaints research was conducted to establish 
whether further complaints had been made after the sending of the 
investigation letter. That research identified that there has been a further 
27 complaints made via the 7726 spam text service in relation to SMS 
messages referring to Cash Carrot. These SMS message were received 
between 16 July 2020 and 14 July 2021. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by Bizfella and, if so, whether 


the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Bizfella contravened regulation 22 of PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 15 November 2019 and 15 July 
2020 Bizfella instigated the sending of 224,550 unsolicited direct 
marketing SMS messages that were received by subscribers contrary to 
regulation 22 of PECR. 


Bizfella is required to ensure that it is acting in compliance with the 
requirements of regulation 22 of PECR, and to ensure that valid consent 
was obtained, or that the soft opt-in requirements were met, to send 


those messages had been acquired. 
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For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what they 
are consenting to. Organisations should therefore always ensure that the 
language used is clear, easy to understand, and not hidden away ina 
privacy policy or small print. Consent will not be valid if individuals are 
asked to agree to receive marketing from “similar organisations”, 
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“partners”, “selected third parties” or other similar generic description. 


Bizfella is an FCA registered credit broker that trades under various 
names including Cash Carrot and Pixie Loans. As part of its business, 
Bizfella operates a number of websites including a Cash Carrot website 


and a Pixie Loans website. 


Individuals can submit loan applications on the Cash Carrot and Pixie 
Loans websites which applications are then passed to Bizfella’s panel of 


lenders to be approved or declined. 


Individuals made loan applications through one or more of the websites 
operated by Bizfella including the Cash Carrot website and the Pixie 
Loans website. Bizfella subsequently sent or arranged to be sent an SMS 
message to inform the relevant individual of the outcome of the loan 
application. That first text message can properly be said to be solicited. 
However, following the initial SMS message, Bizfella then instigated the 


sending of direct marketing messages to those individuals, for up to the 
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next two years, to encourage them to again apply for a loan through the 
Cash Carrot website. Such direct marketing messages could only be 


lawfully sent if consent had been given for the same or the soft opt-in 


rule was satisfied. 


57. Bizfella relied on a statement (referred to as the “main consent” 
statement) and tick box that was included on the Cash Carrot and Pixie 
Loans websites at the time that the individuals applied for the initial loan 
as constituting consent and/or satisfying the soft opt-in rule. That 


statement provided: 


“By submitting your information, you confirm that you provided 
accurate financial information and considered potential future 
income and outgoings in determining your ability to repay. Ticking 
this box also indicates that you have read, understand, and agree 
to the terms of our Privacy Policy and Terms & Conditions of Use, 
and authorize your information to be shared with select lending 
partners, credit brokers and financial savings products, and for 
them to contact you by SMS, email and automated voice 


messaging in relation to the applications. 


a end a 2 combine, analyse and profile my 


information and pass their knowledge on to other organisations for 
the purposes of tracing, providing important information or 
returning assets to me. Your data may also be used for debt 
recovery, fraud prevention, to support the assessment of credit 
risk, pricing and affordable payments. If you do not want your data 


to be used in this way please click here.” 


58. Individuals could only proceed to submit their loan application if they 


ticked the box signifying acceptance of the above statement. 
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The Commissioner has considered the “consents” obtained and, for the 
reasons explained below, is concerned that in each case there are issues 
as to whether the consents can be said to have been freely given, specific 
and informed. The Commissioner is also concerned that the soft opt-in 


rule was not satisfied. 


Valid consent requires an individual to be given real choice and control. 
The statement on the Cash Carrot and Pixie Loans websites did not give 
the individuals any meaningful option but to tick the box signifying 
acceptance as, in the absence of so doing, the individuals could not 


submit their loan applications. 


Further and in any event, the statement on the websites referred to 
contact “in relation to the applications”. The subsequent SMS messages 
sent to the individuals did not relate to the loan application that they had 
submitted but instead were sent to encourage those individuals to make 
further loan applications. Further, the statement did not sufficiently 
inform the individuals that they would receive marketing messages or 


ask them whether they wanted to receive marketing messages. 


The soft opt-in rule requires the individual to have been given a simple 
means of refusing the use of his contact details. However, the statement 
on the websites did not give the individuals any meaningful option but 
to tick the box signifying acceptance as, in the absence of so doing, the 
individuals could not submit their loan applications. Nor was there any 


other simple means of refusing the use of their contact details. 


Bizfella stated that 623,752 SMS messages were delivered to 133,957 
individuals during the contravention period. Bizfella further stated that 
48,342 (or 36%) of the 133,957 individuals had ticked only the “main 
consent” statement. 36% of the 623,752 SMS messages delivered is 
224,550, which is therefore the best estimate of the volume of SMS 
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messages delivered to individuals who had ticked only the main consent 
statement. This statement was, for the reasons explained above, not 


sufficient to satisfy the consent or soft opt-in requirements. 


The Commissioner is therefore satisfied from the evidence he has seen 
that Bizfella did not have the necessary valid consent and the soft opt- 
in rule was not satisfied in relation to the 224,550 direct marketing 


messages received by subscribers. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 
above was serious. This is because between 15 November 2019 -15 July 
2020 (that is an 8 month period), 224,550 direct marketing messages 
were sent, or instigated to be sent, by Bizfella. These messages 
contained direct marketing material for which subscribers had not 
provided valid consent and in relation to which Bizfella cannot rely on 


the soft opt-in exemption. 


Further, the direct marketing messages were sent to encourage 
individuals who had not actively requested renewed contact to submit a 
further loan application. Despite Bizfella not being aware of the 
individuals’ financial circumstances, the message told the individuals 


they were “OK to apply for a loan today”. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 
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Deliberate or negligent contraventions, 


The Commissioner does not consider that Bizfella deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, he has considered whether Bizfella knew or ought reasonably to 
have known that there was a risk that these contraventions would occur. 


He is satisfied that this condition is met for the following reasons: 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. This 
guidance gives clear advice regarding the requirements of consent for 
direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations can 
generally only send, or instigate, marketing messages to individuals if 
that person has specifically consented to receiving them. The guidance 
also provides a full explanation of the “soft opt-in” exemption. The 
Commissioner has also published detailed guidance on consent under 
the GDPR. In case organisations remain unclear on their obligations, the 
ICO operates a telephone helpline. ICO communications about previous 
enforcement action where businesses have not complied with PECR are 


also readily available. 


It is therefore reasonable to suppose that Bizfella should have been 


aware of its responsibilities in this area. 
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Secondly, the Commissioner has gone on to consider whether Bizfella 
failed to take reasonable steps to prevent the contraventions. Again, he 


is satisfied that this condition is met. 


If Bizfella wished to engage in direct marketing by electronic mail, it 
could and should have ensured that its consent capture mechanism 
properly enabled consent to be separately given or withheld for direct 
marketing communications, and that the privacy information provided 
was specific and clear as to what sort of communications would be sent 


and for what purpose. That was simply not done in the present case. 


Further, Bizfella could have sought advice either from the Commissioner 
or from an independent legal advisor in relation to the basis on which it 


proposed to send its unsolicited direct marketing but failed to do so. 


In the circumstances, the Commissioner is satisfied that Bizfella failed to 


take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following 


aggravating features of this case: 
There has been deliberate action for financial or personal gain: in that 


Bizfella sent out the SMS messages as part of a deliberate marketing 


campaign intended to increase its customer base and profit. 
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Advice or guidance has been ignored or not acted upon: in that the 
Commissioner has published detailed guidance for those carrying out 
direct marketing explaining their legal obligations under PECR and yet 


that guidance has not been acted upon by Bizfella. 


The Commissioner did not consider that there were any mitigating factors 


in this case. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking and invited Bizfella to 
make representations in respect of this matter. In reaching his final view, 
the Commissioner has taken into account the representations made by 


Bizfella on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty in 


this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on Bizfella. He has decided on the information that is available 
to him that a penalty remains the appropriate course of action in the 


circumstances of this case. 
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The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited direct marketing messages is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 
they are only messaging those who specifically consent to receive direct 


marketing, or where the soft opt-in requirements can be met. 


The Commissioner has also had regard to the factors set out in 
s108(2)(b) of the Deregulation Act 2015 and to the Regulatory Action 
Policy. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided that 
a penalty in the sum of £30,000 (thirty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 


Conclusion, 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 6 May 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 
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If the Commissioner receives full payment of the monetary penalty by 5 
May 2022 the Commissioner will reduce the monetary penalty by 20% 
to £24000 (twenty four thousand pounds). However, you should be 
aware that the early payment discount is not available if you decide to 


exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 

(a) the imposition of the monetary penalty and/or; 

(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 
unless: 
e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 


recoverable by Order of the County Court or the High Court. In Scotland, 
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the monetary penalty can be enforced in the same manner as an extract 


registered decree arbitral bearing a warrant for execution issued by the 


sheriff court of any sheriffdom in Scotland. 


Dated 6 April 2022 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
oe If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 
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LE1 8DJ 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the 
notice of appeal must include a request for an extension of time 


and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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